Summary

Added: 0 rules
Modified: 0 rules
Renamed: 0 rules
Deleted: 0 rules

Detailed release changes: rules v9.2.0...v9.2.1

Summary

Added: 21 rules
Modified: 46 rules
Renamed: 1 rule
Deleted: 0 rules

Detailed release changes: rules v9.1.0...v9.2.0

Added rules (21)

• anti-analysis/anti-forensic/unload-sysmon.yml
• communication/socket/connect-socket.yml
• communication/socket/udp/connect-udp-socket.yml
• data-manipulation/encryption/chaskey/encrypt-data-using-chaskey.yml
• data-manipulation/encryption/speck/encrypt-data-using-speck.yml
• exploitation/enumeration/make-suspicious-ntquerysysteminformation-call.yml
• exploitation/gadgets/load-ntoskrnl.yml
• exploitation/gadgets/resolve-ntoskrnl-gadgets.yml
• exploitation/spraying/make-suspicious-ntfscontrolfile-call.yml
• host-interaction/file-system/write/clear-file-content.yml
• host-interaction/filter/unload-minifilter-driver.yml
• load-code/dotnet/load-assembly-via-iassembly.yml
• malware-family/donut-loader/load-shellcode-via-donut.yml
• nursery/decrypt-data-using-tripledes-in-dotnet.yml
• nursery/disable-device-guard-features-via-registry-on-windows.yml
• nursery/disable-firewall-features-via-registry-on-windows.yml
• nursery/disable-system-features-via-registry-on-windows.yml
• nursery/disable-system-restore-features-via-registry-on-windows.yml
• nursery/disable-windows-defender-features-via-registry-on-windows.yml
• nursery/encrypt-data-using-tripledes-in-dotnet.yml
• nursery/enter-debug-mode-in-dotnet.yml

Modified rules (46)

• anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
• anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-parallels.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-qemu.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualpc.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml
• communication/dns/reference-dns-over-https-endpoints.yml
• communication/http/server/receive-http-request.yml
• communication/socket/tcp/connect-tcp-socket.yml
• communication/socket/tcp/create-tcp-socket.yml
• data-manipulation/compression/decompress-data-using-aplib.yml
• host-interaction/bootloader/manipulate-boot-configuration.yml
• host-interaction/driver/disable-driver-code-integrity.yml
• host-interaction/gui/taskbar/find/find-taskbar.yml
• host-interaction/gui/window/find/find-graphical-window.yml
• host-interaction/mutex/check-mutex-on-windows.yml
• host-interaction/mutex/create-or-open-mutex-on-windows.yml
• host-interaction/network/address/get-local-ipv4-addresses.yml
• host-interaction/process/inject/allocate-or-change-rwx-memory.yml
• host-interaction/process/list/enumerate-processes-on-remote-desktop-session-host.yml
• linking/runtime-linking/link-function-at-runtime-on-windows.yml
• nursery/enumerate-device-drivers-on-windows.yml
• nursery/impersonate-user.yml
• nursery/persist-via-appcertdlls-registry-key.yml
• nursery/persist-via-autodialdll-registry-key.yml
• nursery/persist-via-bootverificationprogram-registry-key.yml
• nursery/persist-via-dotnet-dbgmanageddebugger-registry-key.yml
• nursery/persist-via-errorhandler-script.yml
• nursery/persist-via-get-variable-hijack.yml
• nursery/persist-via-lsa-registry-key.yml
• nursery/persist-via-natural-language-registry-key.yml
• nursery/persist-via-network-provider-registry-key.yml
• [nursery/persist-via-powershell-prof...

Summary

Added: 2 rules
Modified: 51 rules
Renamed: 3 rules
Deleted: 0 rules

Detailed release changes: rules v9.0.0...v9.1.0

Added rules (2)

• anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs-remotely.yml
• host-interaction/registry/change-registry-key-timestamp.yml

Modified rules (51)

• anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
• host-interaction/process/create/create-process-suspended.yml
• host-interaction/process/inject/inject-apc.yml
• lib/write-process-memory.yml
• nursery/check-for-windows-sandbox-via-mutex.yml
• nursery/persist-via-aedebug-registry-key.yml
• nursery/persist-via-amsi-registry-key.yml
• nursery/persist-via-app-paths-registry-key.yml
• nursery/persist-via-appcertdlls-registry-key.yml
• nursery/persist-via-application-shimming.yml
• nursery/persist-via-appx-registry-key.yml
• nursery/persist-via-autodialdll-registry-key.yml
• nursery/persist-via-autoplayhandlers-registry-key.yml
• nursery/persist-via-bootverificationprogram-registry-key.yml
• nursery/persist-via-code-signing-registry-key.yml
• nursery/persist-via-com-hijack.yml
• nursery/persist-via-command-processor-registry-key.yml
• nursery/persist-via-contextmenuhandlers-registry-key.yml
• nursery/persist-via-cor_profiler_path-registry-value.yml
• nursery/persist-via-default-file-association-registry-key.yml
• nursery/persist-via-disk-cleanup-handler-registry-key.yml
• nursery/persist-via-dotnet-dbgmanageddebugger-registry-key.yml
• nursery/persist-via-dotnet_startup_hooks-registry-key.yml
• nursery/persist-via-explorer-tools-registry-key.yml
• nursery/persist-via-filter-handlers-registry-key.yml
• nursery/persist-via-group-policy-registry-key.yml
• nursery/persist-via-hhctrl-com-hijack.yml
• nursery/persist-via-htmlhelp-author-registry-key.yml
• nursery/persist-via-image-file-execution-options-registry-key.yml
• nursery/persist-via-lsa-registry-key.yml
• nursery/persist-via-natural-language-registry-key.yml
• nursery/persist-via-netsh-registry-key.yml
• nursery/persist-via-network-provider-registry-key.yml
• nursery/persist-via-path-registry-key.yml
• nursery/persist-via-print-monitors-registry-key.yml
• nursery/persist-via-print-processors-registry-key.yml
• nursery/persist-via-rdp-startup-programs-registry-key.yml
• nursery/persist-via-screensaver-registry-key.yml
• nursery/persist-via-silentprocessexit-registry-key.yml
• nursery/persist-via-telemetrycontroller-registry-key.yml
• nursery/persist-via-timeproviders-registry-key.yml
• nursery/persist-via-ts-initialprogram-registry-key.yml
• nursery/persist-via-userinitmprlogonscript-registry-value.yml
• nursery/persist-via-windows-error-reporting-registry-key.yml
• persistence/registry/appinitdlls/persist-via-appinit_dlls-registry-key.yml
• persistence/registry/ginadll/persist-via-ginadll-registry-key.yml
• persistence/registry/persist-via-active-setup-registry-key.yml
• persistence/registry/run/persist-via-run-registry-key.yml
• persistence/registry/winlogon-helper/persist-via-winlogon-helper-dll-registry-key.yml
• persistence/scheduled-tasks/schedule-task-via-schtasks.yml
• persistence/service/persist-via-windows-service.yml

Renamed rules (3)

• host-interaction/mutex/check-mutex-and-terminate-process-on-windows.yml (was host-interaction/mutex/check-mutex.yml)
• host-interaction/mutex/check-mutex-on-windows.yml (was host-interaction/mutex/check-mutex-and-exit.yml)
• host-interaction/mutex/create-or-open-mutex-on-windows.yml (was host-interaction/mutex/create-mutex.yml)

Summary

Added: 3 rules
Modified: 375 rules
Renamed: 9 rules
Deleted: 0 rules

Detailed release changes: rules v8.0.1...v9.0.0

Added rules (3)

• data-manipulation/encryption/rsa/encrypt-data-using-rsa-via-embedded-library.yml
• data-manipulation/encryption/use-bigint-function.yml
• internal/limitation/dynamic/internal-dotnet-file-limitation.yml

Modified rules (375)

• anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
• anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks.yml
• anti-analysis/anti-av/patch-antimalware-scan-interface-function.yml
• anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml
• anti-analysis/anti-debugging/debugger-detection/check-for-outputdebugstring-error.yml
• anti-analysis/anti-debugging/debugger-detection/check-for-protected-handle-exception.yml
• anti-analysis/anti-debugging/debugger-detection/check-for-time-delay-via-queryperformancecounter.yml
• anti-analysis/anti-debugging/debugger-detection/check-process-job-object.yml
• anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml
• anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
• anti-analysis/anti-forensic/clear-logs/clear-windows-event-logs.yml
• anti-analysis/anti-forensic/crash-the-windows-event-logging-service.yml
• anti-analysis/anti-forensic/impersonate-file-version-information.yml
• anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml
• anti-analysis/anti-forensic/self-deletion/self-delete.yml
• anti-analysis/anti-forensic/timestomp/timestomp-file.yml
• anti-analysis/anti-vm/vm-detection/check-for-microsoft-office-emulation.yml
• anti-analysis/anti-vm/vm-detection/check-for-sandbox-username-or-hostname.yml
• anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
• anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml
• anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml
• anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-registry.yml
• anti-analysis/anti-vm/vm-detection/detect-vm-via-disk-hardware-wmi-queries.yml
• anti-analysis/anti-vm/vm-detection/detect-vm-via-motherboard-hardware-wmi-queries.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-vmware.yml
• anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-xen.yml
• collection/acquire-credentials-from-windows-credential-manager.yml
• collection/browser/gather-firefox-profile-information.yml
• collection/database/sql/reference-sql-statements.yml
• collection/database/wmi/reference-wmi-statements.yml
• collection/file-managers/gather-3d-ftp-information.yml
• collection/file-managers/gather-alftp-information.yml
• collection/file-managers/gather-bitkinex-information.yml
• collection/file-managers/gather-blazeftp-information.yml
• collection/file-managers/gather-bulletproof-ftp-information.yml
• collection/file-managers/gather-classicftp-information.yml
• collection/file-managers/gather-coreftp-information.yml
• collection/file-managers/gather-cuteftp-information.yml
• collection/file-managers/gather-cyberduck-information.yml
• collection/file-managers/gather-direct-ftp-information.yml
• collection/file-managers/gather-directory-opus-information.yml
• collection/file-managers/gather-expandrive-information.yml
• collection/file-managers/gather-faststone-browser-information.yml
• collection/file-managers/gather-fasttrack-ftp-information.yml
• collection/file-managers/gather-ffftp-information.yml
• collection/file-managers/gather-filezilla-information.yml
• [collection/file-managers/gather-flashfxp-information.yml](https://github.com/mandiant/capa-r...

Summary

Added: 0 rules
Modified: 0 rules
Renamed: 0 rules
Deleted: 0 rules

Detailed release changes: rules v8.0.0...v8.0.1

Summary

Added: 54 rules
Modified: 21 rules
Renamed: 1 rule
Deleted: 0 rules

Detailed release changes: rules v7.4.0...v8.0.0

Added rules (54)

• collection/browser/get-chrome-cookiemonster.yml
• collection/browser/get-elevation-service-for-chromium-based-browsers.yml
• collection/get-steam-token.yml
• linking/static/touchsocket/linked-against-touchsocket.yml
• nursery/get-shadow-password-file-entry-on-linux.yml
• nursery/persist-via-aedebug-registry-key.yml
• nursery/persist-via-amsi-registry-key.yml
• nursery/persist-via-app-paths-registry-key.yml
• nursery/persist-via-appcertdlls-registry-key.yml
• nursery/persist-via-application-shimming.yml
• nursery/persist-via-appx-registry-key.yml
• nursery/persist-via-autodialdll-registry-key.yml
• nursery/persist-via-autoplayhandlers-registry-key.yml
• nursery/persist-via-bits-job.yml
• nursery/persist-via-bootverificationprogram-registry-key.yml
• nursery/persist-via-code-signing-registry-key.yml
• nursery/persist-via-com-hijack.yml
• nursery/persist-via-command-processor-registry-key.yml
• nursery/persist-via-contextmenuhandlers-registry-key.yml
• nursery/persist-via-cor_profiler_path-registry-value.yml
• nursery/persist-via-default-file-association-registry-key.yml
• nursery/persist-via-disk-cleanup-handler-registry-key.yml
• nursery/persist-via-dotnet-dbgmanageddebugger-registry-key.yml
• nursery/persist-via-dotnet_startup_hooks-registry-key.yml
• nursery/persist-via-errorhandler-script.yml
• nursery/persist-via-explorer-tools-registry-key.yml
• nursery/persist-via-filter-handlers-registry-key.yml
• nursery/persist-via-get-variable-hijack.yml
• nursery/persist-via-group-policy-registry-key.yml
• nursery/persist-via-hhctrl-com-hijack.yml
• nursery/persist-via-htmlhelp-author-registry-key.yml
• nursery/persist-via-image-file-execution-options-registry-key.yml
• nursery/persist-via-iphlpapi-dll-hijack.yml
• nursery/persist-via-lnk-shortcut.yml
• nursery/persist-via-lsa-registry-key.yml
• nursery/persist-via-natural-language-registry-key.yml
• nursery/persist-via-netsh-registry-key.yml
• nursery/persist-via-network-provider-registry-key.yml
• nursery/persist-via-path-registry-key.yml
• nursery/persist-via-powershell-profile.yml
• nursery/persist-via-print-monitors-registry-key.yml
• nursery/persist-via-print-processors-registry-key.yml
• nursery/persist-via-rdp-startup-programs-registry-key.yml
• nursery/persist-via-silentprocessexit-registry-key.yml
• nursery/persist-via-telemetrycontroller-registry-key.yml
• nursery/persist-via-timeproviders-registry-key.yml
• nursery/persist-via-ts-initialprogram-registry-key.yml
• nursery/persist-via-userinitmprlogonscript-registry-value.yml
• nursery/persist-via-windows-accessibility-tools.yml
• nursery/persist-via-windows-error-reporting-registry-key.yml
• nursery/persist-via-windows-terminal-profile.yml
• nursery/set-shadow-password-file-entry-on-linux.yml
• nursery/write-to-browser-extension-directory.yml
• runtime/dotnet/compiled-with-dotnet-aot.yml

Modified rules (21)

• anti-analysis/anti-av/block-operations-on-executable-memory-pages-using-arbitrary-code-guard.yml
• data-manipulation/encryption/create-new-key-via-cryptacquirecontext.yml
• host-interaction/file-system/copy/copy-file.yml
• host-interaction/file-system/move/move-file.yml
• host-interaction/file-system/write/write-file-on-windows.yml
• host-interaction/process/get-process-filename.yml
• host-interaction/registry/create/set-registry-value.yml
• [h...

Summary

Added: 14 rules
Modified: 2 rules
Renamed: 0 rules
Deleted: 0 rules

Detailed release changes: rules v7.3.0...v7.4.0

Added rules (14)

• anti-analysis/packer/nmm-protect/packed-with-nmm-protect.yml
• host-interaction/driver/complete-processing-asynchronous-io-request.yml
• host-interaction/firewall/modify/access-firewall-policy-via-inetfwpolicy2.yml
• host-interaction/firewall/modify/access-firewall-rule-properties-via-inetfwrule.yml
• host-interaction/os/hide-shutdown-actions-via-policy.yml
• host-interaction/process/get-process-filename.yml
• host-interaction/registry/open-recentdocs-registry-key.yml
• linking/runtime-linking/populate-syswhispers2-syscall-list.yml
• nursery/access-unmanaged-com-objects-in-dotnet.yml
• nursery/implement-ui-automation-client-in-dotnet.yml
• nursery/interact-with-shortcut-via-iwshshortcut-in-dotnet.yml
• nursery/interact-with-windows-scripting-host-in-dotnet.yml
• nursery/use-dotnet-library-simplejson.yml
• nursery/use-dotnet-library-websocket-sharp.yml

Modified rules (2)

• anti-analysis/anti-vm/vm-detection/check-for-unmoving-mouse-cursor.yml
• nursery/execute-syscall.yml

Summary

Added: 6 rules
Modified: 1 rule
Renamed: 1 rule
Deleted: 0 rules

Detailed release changes: rules v7.2.0...v7.3.0

Added rules (6)

• host-interaction/network/traffic/filter/delete-network-filter-via-wfp-api.yml
• host-interaction/network/traffic/filter/enumerate-network-filters-via-wfp-api.yml
• linking/static/minhook/linked-against-minhook.yml
• linking/static/sqlite3/linked-against-sqlcipher.yml
• nursery/check-thread-suspend-count-exceeded.yml
• nursery/create-thread-bypassing-process-freeze.yml

Modified rules (1)

• data-manipulation/encryption/hc-128/encrypt-data-using-hc-128-via-wolfssl.yml

Renamed rules (1)

• host-interaction/hardware/firmware/get-system-firmware-table.yml (was nursery/get-system-firmware-table.yml)

Summary

Added: 5 rules
Modified: 6 rules
Renamed: 0 rules
Deleted: 0 rules

Detailed release changes: rules v7.1.0...v7.2.0

Added rules (5)

• anti-analysis/anti-av/overwrite-dll-text-section-to-remove-hooks.yml
• communication/socket/attach-bpf-to-socket-on-linux.yml
• nursery/decode-data-using-base64-via-vbmi-lookup-table.yml
• nursery/delete-file-on-linux.yml
• nursery/upload-file-to-onedrive.yml

Modified rules (6)

• anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml
• host-interaction/file-system/write/write-file-on-linux.yml
• host-interaction/log/debug/write-event/print-debug-messages.yml
• lib/calculate-modulo-256-via-x86-assembly.yml
• load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
• nursery/invoke-dotnet-assembly-method.yml

Summary

Added: 24 rules
Modified: 42 rules
Renamed: 2 rules
Deleted: 0 rules

Detailed release changes: rules v7.0.1...v7.1.0

Added rules (24)

• anti-analysis/anti-forensic/self-deletion/self-delete-using-alternate-data-streams.yml
• compiler/dart/compiled-with-dart.yml
• data-manipulation/encryption/rc4/encrypt-data-using-rc4-via-systemfunction033.yml
• host-interaction/driver/interact-with-driver-via-ioctl.yml
• host-interaction/gui/window/hide/hide-graphical-window-from-taskbar.yml
• impact/wipe-disk/delete-drive-layout-via-ioctl.yml
• nursery/bypass-hidden-api-restrictions-via-jni-on-android.yml
• nursery/change-memory-permission-on-linux.yml
• nursery/check-file-permission-on-linux.yml
• nursery/check-if-process-is-running-under-android-emulator-on-android.yml
• nursery/get-current-process-filesystem-mounts-on-linux.yml
• nursery/get-current-process-memory-mapping-on-linux.yml
• nursery/get-disk-information-via-ioctl.yml
• nursery/get-system-property-on-android.yml
• nursery/get-volume-information-via-ioctl.yml
• nursery/hook-routines-via-lsplant.yml
• nursery/load-packed-dex-via-jiagu-on-android.yml
• nursery/map-or-unmap-memory-on-linux.yml
• nursery/modify-api-blacklist-or-denylist-via-jni-on-android.yml
• nursery/truncate-file-on-linux.yml
• nursery/unmount-volume-via-ioctl.yml
• persistence/act-as-share-provider-dll.yml
• persistence/act-as-time-provider-dll.yml
• persistence/act-as-windbg-extension.yml

Modified rules (42)

• collection/keylog/log-keystrokes-via-application-hook.yml
• communication/dns/resolve-dns.yml
• communication/socket/create-raw-socket.yml
• communication/socket/get-socket-status.yml
• communication/socket/initialize-winsock-library.yml
• communication/socket/receive/receive-data-on-socket.yml
• communication/socket/send/send-data-on-socket.yml
• communication/socket/set-socket-configuration.yml
• communication/socket/tcp/connect-tcp-socket.yml
• communication/socket/tcp/create-tcp-socket.yml
• communication/socket/udp/send/create-udp-socket.yml
• compiler/go/compiled-with-go.yml
• data-manipulation/encryption/dpapi/encrypt-data-using-dpapi.yml
• host-interaction/driver/install-driver.yml
• host-interaction/file-system/change-file-permission-on-linux.yml
• host-interaction/file-system/files/list/enumerate-files-on-linux.yml
• host-interaction/file-system/files/list/enumerate-files-recursively.yml
• host-interaction/file-system/read/read-file-on-linux.yml
• host-interaction/file-system/write/write-file-on-linux.yml
• host-interaction/gui/set-application-hook.yml
• host-interaction/hardware/memory/get-memory-information.yml
• host-interaction/hardware/storage/get-disk-size.yml
• host-interaction/mutex/create-semaphore-on-linux.yml
• host-interaction/mutex/lock-file.yml
• host-interaction/mutex/lock-semaphore-on-linux.yml
• host-interaction/mutex/unlock-semaphore-on-linux.yml
• host-interaction/process/create/create-process-on-linux.yml
• host-interaction/session/get-current-user-on-linux.yml
• host-interaction/thread/create/create-thread.yml
• lib/delay-execution.yml
• lib/duplicate-stdin-and-stdout.yml
• linking/runtime-linking/link-function-at-runtime-on-windows.yml
• linking/runtime-linking/link-many-functions-at-runtime.yml
• load-code/shellcode/execute-shellcode-via-windows-callback-function.yml
• nursery/encrypt-data-using-salsa20-or-chacha.yml
• nursery/get-current-pid-on-linux.yml
• nursery/get-password-database-entry-on-linux.yml
• [nursery/get-socket-information.yml](https://gi...